CVE-2025-59953: LMDeploy — CRITICAL

Q: Is CVE-2025-59953 actively exploited?

No confirmed active exploitation of CVE-2025-59953 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2025-59953?

Update to patched version: LMDeploy 0.10.2.

Q: What is the CVSS score for CVE-2025-59953?

CVE-2025-59953 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.68%.

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.1 and prior to version 0.10.2, the LMdeploy implements an rpc server (AsyncRPCServer in zmq_rpc.py) for supporting the RPC communications. In its core functionality call_and_response(), I...

Full CISO analysis pending enrichment.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LMDeploy	pip	>= 0.9.1, < 0.10.2	`0.10.2`
8.1K 1 dependents Pushed 8d ago 60% patched ~17d to patch Full package profile →

Do you use LMDeploy? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 51% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

N/A

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

Patch available

Update LMDeploy to version 0.10.2

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2025-59953?

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.1 and prior to version 0.10.2, the LMdeploy implements an rpc server (AsyncRPCServer in zmq_rpc.py) for supporting the RPC communications. In its core functionality call_and_response(), I found it will directly use the pickles.loads() to deserialize the received messages without any sanitization, hence resulting in a remote code execution vulnerability by this RPC server. Version 0.10.2 contains a patch.

Is CVE-2025-59953 actively exploited?

No confirmed active exploitation of CVE-2025-59953 has been reported, but organizations should still patch proactively.

How to fix CVE-2025-59953?

Update to patched version: LMDeploy 0.10.2.

What is the CVSS score for CVE-2025-59953?

CVE-2025-59953 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.68%.

What are the technical details?

Original Advisory

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.1 and prior to version 0.10.2, the LMdeploy implements an rpc server (AsyncRPCServer in zmq_rpc.py) for supporting the RPC communications. In its core functionality call_and_response(), I found it will directly use the pickles.loads() to deserialize the received messages without any sanitization, hence resulting in a remote code execution vulnerability by this RPC server. Version 0.10.2 contains a patch.

Weaknesses (CWE)

CWE-502 Deserialization of Untrusted Data Primary CWE-502 Deserialization of Untrusted Data Primary CWE-502 Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.